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~ The MAILING DATE of this communication appears on the cover sheet with the correspondence address « 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1704(b). 

Status 

1 )[3 Responsive to communication(s) filed on 14 October 2005 . 
2a)l3 This action is FINAL. 2b)D This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) C3 Claim(s) 1-21 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) [>3 Claim(s) 1-21 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10) D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 

1 1) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or {f). 
a)D All b)D Some * c)D None of: 

1. D Certified copies of the priority documents have been received. 

2. Q Certified copies of the priority documents have been received in Application No. . 

3. Q Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 

1 . Claims 1 -1 9 were pending in this application at the time of the previous Office 
Action. New claims 20 and 21 have been added by the latest amendment. Therefore 
claims 1-21 are pending and have been examined. 

Response to Arguments 

2. Applicant's arguments filed 10-14-2005 have been fully considered but they are 
not persuasive. 

The applicant asserts that Nachenberg fails to teach the features of claim 1 
regarding an "exception handler" The common definition of the term is that an exception 
handler is a section of code which defines the recovery actions to be performed in 
response to exceptions raised within that code. The teaching of Nachenberg do indeed 
meet this definition at the passages cited. 

The applicant asserts that Nachenberg fails to teach a "Pointer to an exception 
handler" yet such is indeed taught by Nachenberg at the passages cited, for example 
col. 3 lines 54-59. 

Claim Rejections - 35 USC § 102 

3. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 
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A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
States. 

4. Claims 1-21 are rejected under 35 U.S.C. 102(b) as being clearly anticipated by 
Nachenberg (US 5,826,013). 

As for claims 1, 13, 16, and 21, Nachenberg teaches a method of detecting a 
computer virus comprising: emulating computer executable code in a subject file (col. 6 
lines 45-48), and detecting at least one modification to a memory state of a computer 
system, wherein the at least one modification is caused by the emulation of the 
computer executable code (col. 6 line 54 through col. 7 line 8, col. 12 line 64 through 
col. 13 line 10), and comprises installation of an exception handler or an interrupt 
handler (col. 3 lines 37-46, col. 4 lines 24-31). 

As for claims 2, 5, 14, and 17, Nachenberg teaches the at least one modification 
comprises installation of an interrupt handler (col. 3 lines 37-46, col. 4 lines 24-31), and 
the emulated computer executable code comprises instructions for forcing of a 
corresponding exception (col. 3 lines 37-46, col. 4 lines 24-31 ). 

As for claims 3, 4, 6, 15, and 18, Nachenberg teaches detection of the writing of 
a new pointer to at least one predetermined memory address in a system memory for 
storing an exception handler pointer (col. 3 lines 54-59, col. 12 lines 64 through col. 13 
line 10). 



Application/Control Number: 09/905,340 



Art Unit: 2137 



Page 4 



As for claim 7, and 19, Nachenberg teaches detecting use of a predetermined 
instruction to retrieve an address in a system memory corresponding to an interrupt 
descriptor table (col. 9 lines 24-32, col. 11 lines 23-28). 

As for claims 8-11, claims 8, 9, and 1 1 are directed to the computer program 
product embodied in a memory medium causing a computer system to carry out the 
method of claim 1 via transmission of the data signal of claim 10. Therefore these 
claims are rejected on the same basis as is claim 1 . 

As for claim 12, Nachenberg teaches a detector that monitors a system memory 
(col. 4 lines 25-29). 

As for claims 20, Nachenberg teaches a first and a second memory component 
wherein access to the first memory component is more restricted than is access to the 
second memory component (abstract, fig 2) 

Conclusion 

5. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 .1 36(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 



Application/Control Number: 09/905,340 



Page 5 



Art Unit: 2137 

TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

6. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Paul E. Callahan whose telephone number is (571) 272- 
3869. The examiner can normally be reached on M-F from 9 to 5. 

If attempts to reach the examiner by telephone are unsuccessful, the Examiner's 
supervisor, Emmanuel Moise, can be reached on (571 ) 272-3865. The fax phone 
number for the organization where this application or proceeding is assigned is: (571) 
273-8300. 
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